
    B                        S r SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJ	r	  SSK
Jr  SS	KJr  SS
KJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SSKJr  SrSrSrSr Sr!Sr"Sr#Sr$Sr%Sr&\\RO                  S5      -   \RO                  S5      -   \ RO                  S5      -   \!RO                  S5      -   S-   r(SSRS                  \"\#\$\%\&/5      -   r*\" \(\*5      r+SS /r,S!r-\" \\"5      r.\" \\#5      r/\" \\$5      r0\" \ \%5      r1\" \!\&5      r2S" r3S# r4S$\Rj                  " 5       -   S%-   S&-   S'-   r6S$\Rj                  " 5       -   S(-   S)-   S*-   S+-   S,-   S--   S.-   S/-   S0-   r7S1r8\" S25      r9\" S3S4S5\6/S6\90S79r:\" / S8QS6\90S79r;\" S3S4S9\7/S6\90S79r<\" S3S4S:\8/\" S;5      \" S<5      \9S=.S79r=\" S3S4S:\7/\" S;5      \" S>5      \" S<5      \9S?.S79r>\" S3S4S@\7/\" SASBSC.5      \" SD5      \9SE.S79r? " SF SG\5      r@gH)Iz
Implementation of HMAC key management command for GCS.

NOTE: Any modification to this file or corresponding HMAC logic
should be submitted in its own PR and release to avoid
concurrency issues in testing.
    )absolute_import)division)print_function)unicode_literals)Command)CommandArgument)ApiSelectorCommandException)CreateHelpText)LogCommandParams)PopulateProjectId)GetCloudApiInstance)GcloudStorageFlag)GcloudStorageMap)InsistAscii)	shim_utilz=
  gsutil hmac create [-p <project>] <service_account_email>
z1
  gsutil hmac delete [-p <project>] <access_id>
z.
  gsutil hmac get [-p <project>] <access_id>
zJ
  gsutil hmac list [-a] [-l] [-p <project>] [-u <service_account_email>]
zR
  gsutil hmac update -s (ACTIVE|INACTIVE) [-e <etag>] [-p <project>] <access_id>
a  
<B>CREATE</B>
  The ``hmac create`` command creates an HMAC key for the specified service
  account:

    gsutil hmac create test.service.account@test_project.iam.gserviceaccount.com

  The secret key material is only available upon creation, so be sure to store
  the returned secret along with the access_id.

<B>CREATE OPTIONS</B>
  The ``create`` sub-command has the following option

  -p <project>                Specify the ID or number of the project in which
                              to create a key.
a  
<B>DELETE</B>
  The ``hmac delete`` command permanently deletes the specified HMAC key:

    gsutil hmac delete GOOG56JBMFZX6PMPTQ62VD2

  Note that keys must be updated to be in the ``INACTIVE`` state before they can be
  deleted.

<B>DELETE OPTIONS</B>
  The ``delete`` sub-command has the following option

  -p <project>                Specify the ID or number of the project from which to
                              delete a key.
a  
<B>GET</B>
  The ``hmac get`` command retrieves the specified HMAC key's metadata:

    gsutil hmac get GOOG56JBMFZX6PMPTQ62VD2

  Note that there is no option to retrieve a key's secret material after it has
  been created.

<B>GET OPTIONS</B>
  The ``get`` sub-command has the following option

  -p <project>                Specify the ID or number of the project from which to
                              get a key.
a  
<B>LIST</B>
  The ``hmac list`` command lists the HMAC key metadata for keys in the
  specified project. If no project is specified in the command, the default
  project is used.

<B>LIST OPTIONS</B>
  The ``list`` sub-command has the following options

  -a                          Show all keys, including recently deleted
                              keys.

  -l                          Use long listing format. Shows each key's full
                              metadata excluding the secret.

  -p <project>                Specify the ID or number of the project from
                              which to list keys.

  -u <service_account_email>  Filter keys for a single service account.
a  
<B>UPDATE</B>
  The ``hmac update`` command sets the state of the specified key:

    gsutil hmac update -s INACTIVE -e M42da= GOOG56JBMFZX6PMPTQ62VD2

  Valid state arguments are ``ACTIVE`` and ``INACTIVE``. To set a key to state
  ``DELETED``, use the ``hmac delete`` command on an ``INACTIVE`` key. If an etag
  is set in the command, it will only succeed if the provided etag matches the etag
  of the stored key.

<B>UPDATE OPTIONS</B>
  The ``update`` sub-command has the following options

  -s <ACTIVE|INACTIVE>        Sets the state of the specified key to either
                              ``ACTIVE`` or ``INACTIVE``.

  -e <etag>                   If provided, the update will only be performed
                              if the specified etag matches the etag of the
                              stored key.

  -p <project>                Specify the ID or number of the project in
                              which to update a key.

z

z
  You can use the ``hmac`` command to interact with service account `HMAC keys
  <https://cloud.google.com/storage/docs/authentication/hmackeys>`_.

  The ``hmac`` command has five sub-commands:
INACTIVEACTIVEz%a, %d %b %Y %H:%M:%S GMTc                 .    [        U < SU< SU< 35      $ )N z= requires an Access ID to be specified as the last argument.
r
   )command_name
subcommandsynopsiss      &platform/gsutil/gslib/commands/hmac.py_AccessIdExceptionr      s    	Z+
, ,    c                 t   SS jnSU R                   -  nX!" SU R                  5      -  nX!" SU R                  5      -  nX!" SU R                  5      -  nX!" SU R                  R                  [        5      5      -  nX!" SU R                  R                  [        5      5      -  nX!" SU R                  S	S
9-  nU$ )z4Format the key metadata for printing to the console.c                 6    SnSX0S-   U4-  nU(       a  US-  nU$ )z=Format the metadata name-value pair into two aligned columns.   z	%-*s %s:r    )namevaluenew_linewidthinfo_strs        r   
FormatInfo&_KeyMetadataOutput.<locals>.FormatInfo   s,    EeCZ77H$hOr   zAccess ID %s:
StatezService AccountProjectzTime CreatedzTime Last UpdatedEtagF)r&   )T)	accessIdstateserviceAccountEmail	projectIdtimeCreatedstrftime_TIME_FORMATupdatedetag)metadatar)   messages      r   _KeyMetadataOutputr9      s      1 11'	Z00'	Z)8+G+GHH'	Z	8#5#566'	Z ,,55lCE E'	Z+ ((11,?A A'	Z>>'	.r   z--format=value[separator="z"](z-format("Access ID:   {}", metadata.accessId),z"format("Secret:      {}", secret))z%"](format("Access ID {}:", accessId),z,format("	State:                 {}", state),z:format("	Service Account:       {}", serviceAccountEmail),z0format("	Project:               {}", projectId),z$format("	Time Created:          {}",z9 timeCreated.date(format="%a',' %d %b %Y %H:%M:%S GMT")),z$format("	Time Last Updated:     {}",z5 updated.date(format="%a',' %d %b %Y %H:%M:%S GMT")),z+format("	Etag:                  {}", etag))zW--format=table[no-heading](format("{}	{:<12} {}",accessId, state, serviceAccountEmail))z	--projectstoragehmaccreate-pgcloud_commandflag_map)r:   r;   deletedescribelistz--allz--service-account)-a-ur=   z--long)rD   -lrE   r=   updatez
--activatez--deactivate)r   r   z--etag)-s-er=   c                     ^  \ rS rSrSr\R                  " SSSSSS\R                  /\R                  \	\
R                  " 5       /\
R                  " 5       /\
R                  " 5       /\
R                  " 5       /\
R                  " 5       /S.S	9
r\R                  " S/ S
S\\\\\\S.S9rU 4S jrSS jrSS jrSS jrSS jrSS jrS rSrU =r$ )HmacCommandi  z&Implementation of gsutil hmac command.r;         z
ae:lp:s:u:Tr<   rA   getrC   rG   )	min_argsmax_argssupported_sub_argsfile_url_okurls_start_arggs_api_supportgs_default_apiusage_synopsisargparse_argumentscommand_helpz-CRUD operations on service account HMAC keys.)	help_namehelp_name_aliases	help_typehelp_one_line_summary	help_textsubcommand_help_textc                    > U R                   S   S:X  a!  SU R                   ;   a  [        S[        00 S9nO$[        [        [        [
        [        [        S.0 S9n[        TU ]%  U5      $ )Nr   rC   rF   r>   )r<   rA   rG   rO   rC   )
argsr   LIST_COMMAND_LONG_FORMATCREATE_COMMANDDELETE_COMMANDUPDATE_COMMANDGET_COMMANDLIST_COMMANDsuperget_gcloud_storage_args)selfgcloud_storage_map	__class__s     r   ri   #HmacCommand.get_gcloud_storage_args<  sn    yy|v$$))"3+ ":;
 ,&&& " 	 7*+=>>r   c                    U R                   (       a  U R                   S   U l        O+Sn[        UU R                  U R                  [
        4-  5      e[        XS9nUR                  U R                  U R                  SS9n[        S<S SUR                  R                  < 35        [        S	<S SUR                  < 35        g
)z'Creates HMAC key for a service account.r   zI%s %s requires a service account to be specified as the last argument.
%sthread_stategsproviderz
Access ID:12r   zSecret:N)ra   service_account_emailr   r   action_subcommand_CREATE_SYNOPSISr   CreateHmacKey
project_idprintr7   r.   secret)rj   rp   err_msg
gsutil_apiresponses        r   _CreateHmacKeyHmacCommand._CreateHmacKeyP  s    yy#'99Q<d &g
d446F
GHI I %TEJ''(,(B(B15 ( 7H 
h&7&7&@&@
AB		8??
34r   c                     U R                   (       a  U R                   S   nO%[        U R                  U R                  [        5      e[        XS9nUR                  U R                  USS9  g)zDeletes an HMAC key.r   ro   rq   rr   N)ra   r   r   rv   _DELETE_SYNOPSISr   DeleteHmacKeyry   )rj   rp   	access_idr}   s       r   _DeleteHmacKeyHmacCommand._DeleteHmacKeyd  s[    yy))A,it00$2H2H/1 1 %TEJT__i$Gr   c                     U R                   (       a  U R                   S   nO%[        U R                  U R                  [        5      e[        XS9nUR                  U R                  USS9n[        [        U5      5        g)z!Gets HMAC key from its Access Id.r   ro   rq   rr   N)
ra   r   r   rv   _GET_SYNOPSISr   
GetHmacKeyry   rz   r9   rj   rp   r   r}   r~   s        r   _GetHmacKeyHmacCommand._GetHmacKeyp  sk    yy))A,it00$2H2H,. . %TEJ$$T__i$$OH	
X
&'r   c                    U R                   (       a.  [        U R                  < SU R                  < S[        < 35      e[        XS9nUR                  U R                  U R                  U R                  SS9nSnU R                  (       a(  U H!  n[        [        U5      5        [        5         M#     gU H2  n[        UUR                  UR                  UR                  4-  5        M4     g)z1Lists HMAC keys for a project or service account.r   z  received unexpected arguments.
ro   rq   rr   z%s	%-12s %sN)ra   r   r   rv   _LIST_SYNOPSISr   ListHmacKeysry   ru   show_all	long_listrz   r9   r.   r/   r0   )rj   rp   r}   r~   short_list_formatitems         r   _ListHmacKeysHmacCommand._ListHmacKeys~  s    yyd44nFG G %TEJ&&t'+'A'A'+}}04 ' 6H
 '~~$ &'  $}}djj$*B*BCD 	E r   c                    U R                   (       d/  [        SU R                  < SU R                  < S[        < 35      eU R                   [
        ;  a!  [        SSR                  [
        5      -  5      eU R                  (       a  U R                  S   nO%[        U R                  U R                  [        5      e[        XS9nUR                  U R                  UU R                   U R                  SS	9n[        [        U5      5        g
)zUpdate an HMAC key's state.z"A state flag must be supplied for r   r   z&The state flag value must be one of %sz, r   ro   rq   rr   N)r/   r   r   rv   _UPDATE_SYNOPSIS_VALID_UPDATE_STATESjoinra   r   r   UpdateHmacKeyry   r6   rz   r9   r   s        r   _UpdateHmacKeyHmacCommand._UpdateHmacKey  s    ::d446FHI I 
/	/E!YY';<= > >yy))A,it00$2H2H/1 1 %TEJ''(1(,

(,		15	 ( 7H 

X
&'r   c                    U R                   R                  SS9[        R                  :w  a  [	        S5      eU R
                  R                  S5      U l        U R                  SS9  [        U R                  S9  SU l        SU l        S	U l        S	U l        SU l        U R                  (       aw  U R                   Hg  u  pUS
:X  a  X l        M  US:X  a  [!        US5        X l        M-  US:X  a  X l        M;  US:X  a	  SU l        MJ  US:X  a	  SU l        MY  US:X  d  Ma  X l        Mi     U R"                  (       d  [%        S5      U l        U R&                  U R(                  U R*                  U R,                  U R.                  S.nU R                  U;  a(  [	        SU R                  < SU R0                  < S35      e[        U R                  /S9  X0R                     " 5         g)z)Command entry point for the hmac command.rq   rr   z9The "hmac" command can only be used with the GCS JSON APIr   T)
check_args)sub_optsNFrE   r=   z/Invalid non-ASCII character found in project IDrH   rD   rF   rI   rN   zInvalid subcommand "z
" for the z! command.
See "gsutil help hmac".)subcommands)r}   GetApiSelectorr	   JSONr   ra   poprv   ParseSubOptsr   r   ru   r/   r   r   r6   r   ry   r   r   r   r   r   r   r   )rj   oamethod_for_args       r   
RunCommandHmacCommand.RunCommand  s    %%t%48H8HH
EG G "YY]]1-D& dmm,!%DDJDMDNDI}}--$!9'(
$$Y
aJ
K/$Y*$Y$-$Y$.$Y)    ??)$/do %%%%""%%N ^3"44d6G6GI J J $"8"8!9:))*,r   )rv   r6   r   ry   ru   r   r/   )N)__name__
__module____qualname____firstlineno____doc__r   CreateCommandSpecr	   r   	_SYNOPSISr   %MakeZeroOrMoreCloudOrFileURLsArgumentcommand_specHelpSpec_DETAILED_HELP_TEXT_create_help_text_delete_help_text_get_help_text_list_help_text_update_help_text	help_specri   r   r   r   r   r   r   __static_attributes____classcell__)rl   s   @r   rK   rK     s    .**%!&&' %%$JJLM$JJLM!GGIJ"HHJK$JJLM,& L#%%!%	)?(5(
H(E0(26 6r   rK   N)Ar   
__future__r   r   r   r   gslib.commandr   gslib.command_argumentr   gslib.cs_api_mapr	   gslib.exceptionr   gslib.help_providerr   gslib.metricsr   gslib.project_idr   gslib.utils.cloud_api_helperr   gslib.utils.shim_utilr   r   gslib.utils.text_utilr   gslib.utilsr   rw   r   r   r   r   _CREATE_DESCRIPTION_DELETE_DESCRIPTION_GET_DESCRIPTION_LIST_DESCRIPTION_UPDATE_DESCRIPTIONlstripr   r   _DESCRIPTIONr   r   r4   r   r   r   r   r   r   r9   get_format_flag_newline_CREATE_COMMAND_FORMAT_DESCRIBE_COMMAND_FORMAT_LIST_COMMAND_SHORT_FORMAT_PROJECT_FLAGrc   rd   rf   rg   rb   re   rK   r#   r   r   <module>r      sU   '  % ' ! 2 ( , . * . < 3 2 - !    "     ( 2  0 7 7 ==!!$'(*8*?*?*EF$$T*+-34	
 ii  %Y= "H- *"#35HI "#35HI /?@ 1BC"#35HI ,. 7#;;=>@EFIJ ?? 
 !9#D#D#FF+,34 BB 8	8
 ,, BB ,, >> 3	3 -  "+.!vx1GHm "1N&*M,$%
 vz3KLM"$  vv/IJ( 34 ,vv/GH() 34	  "vx1IJ &* 
 h'
L' Lr   